Regulation (EU) 2022/2554 on digital operational resilience in the financial sector (DORA) applies to most regulated entities in the European financial sector, such as credit institutions and insurers, but also certain third-party ICT service providers.

Critical ICT third-party service providers designated as such by the European supervisory authorities (ESAs) come directly within the scope of DORA. They provide critical or important functions to the financial services sector and must also fulfill many of their own obligations in addition to those stipulated in their regulated clients’ contracts.

DORA also impacts many ICT service providers that are not within this ‘critical’ cohort through the obligations of financial companies to manage third-party risk.

The framework laid down by DORA is intended to strengthen digital operational resilience of the European financial sector as a whole. Amongst other things, it obliges in-scope entities to implement an enhanced resilience framework impacting various levels of their organisation, including cybersecurity risk management, incident management, stress tests and the management of ICT third party suppliers.

DORA is bolstered by regulatory technical standards (RTSs), implementing technical standards (ITSs) and guidelines formulated by the ESAs: EBA, EIOPA and ESMA. Some of these have already been adopted, such as the ITS on the creation of a standard template for the mandated information register, whereas others are yet to be approved.

The reporting obligations required by DORA by means of an information register are also noteworthy. Financial businesses are required to record all contractual agreements with third-party ICT service providers in a register and make details available to their competent authority on request.

“Given that DORA is now upon us, it presents affected businesses with potentially major challenges,” said Florian Elsinghorst, an expert for regulated industries at Pinsent Masons. “In particular, in-scope entities need to put a lot of effort into managing ICT third party risk: the vast majority of IT services are covered by DORA. Financial organisations must adapt their existing contracts with third-party ICT service providers to be DORA-compliant, which may entail a substantial amount of contract management and negotiation work.”

Andreas Carney, a technology and financial services sourcing expert at Pinsent Masons, said: “Now is a good time to take stock of what has been achieved in terms of implementation and assess what more needs to be done to achieve compliance said. The application of DORA from today will no doubt draw it into sharper focus for regulators – they will be interested in the level of compliance that has been achieved.”

Carney highlighted that third party risk management is naturally a key aspect of the DORA framework. DORA’s requirements in this regard apply to outsourcing arrangements but also other ICT services arrangements.

“While entities may have implemented previous regulatory requirements specific to outsourcing or cloud, DORA adds another layer of requirements – as well as the need to look at their entire ICT services environment,” he said. “DORA includes detailed requirements for subcontracting and these should be considered not only by the regulated entities themselves, but also third-party suppliers to those entities in how they contract and manage their own supply chain. Other aspects of DORA will also have a ‘flow down’ effect on IT service providers.”

“Our consulting experience shows that DORA can also mean a major implementation effort for IT service providers,” Daniel Widmann, also of Pinsent Masons, said. “They are asked by their clients from the financial sector to adapt existing contracts, the implementation of which may cause difficulties in practice. This is also due to the fact that IT services are often categorised differently by financial companies in terms of criticality. IT service providers are faced with the challenge of having to adapt an often standardised service for customers in the financial sector. It is therefore all the more important for IT service providers to understand which obligations are mandatory under DORA and where there is room for negotiation.”

“We are seeing different approaches being adopted for implementation by both regulated entities and ICT suppliers,” Carney said. “These vary from clients managing implementation in-house, where we support on developing an understanding of DORA’s requirements, how it applies to their business, and identifying the steps needed to comply, right through to relying on us for full end-to-end support where we advise on all of DORA’s requirements, prepare templates and manage negotiation of ICT service contracts.”

An FCA investigation revealed that between 2015 and 2019, Macintyre Hudson LLP (MHA) failed to prepare four client asset reports to the required standards. These reports, which are crucial for ensuring firms comply with the FCA’s client assets sourcebook (CASS) rules, were found to be deficient in several areas.

The auditor failed to identify and report 25 breaches of the CASS rules by two regulated firms.

In a briefing note on 20 August, Elizabeth Budd, financial services expert at Pinsent Masons, said: “The CASS rules are high level and lack clarity making it difficult to be 100% compliant. However, the CASS audit does provide protection to clients and indeed to firms to ensure that there is an independent review of CASS compliance. The protection of client assets after all is one of the core tenets of the regulatory system and even technical breaches need to be identified and addressed by the firm and failing that by the CASS auditor, to ensure that protection is as robust as it can be.”

The breaches identified in this instance included the co-mingling of client money with firm money, absent acknowledgment letters, insufficient documentation, and the use of ‘dummy’ counterparty accounts in live investment management systems.

The FCA decided to censure rather than fine MHA. Budd said: “This public censure of a CASS auditor is the lowest level of sanction that the FCA can impose, but that should not in any way detract from its seriousness. CASS auditors will likely be looking at toughening their processes to ensure that they are meeting their obligations fully and firms can expect an even more challenging CASS audit as a result.”

This censure was quickly followed by another significant FCA action against a major audit firm. PricewaterhouseCoopers (PwC) was fined £15 million for failing to report suspected fraudulent activity at London Capital & Finance (LCF). The FCA found that PwC had encountered significant issues during its 2016 audit of LCF, including aggressive behaviour from a senior LCF employee and the provision of inaccurate and misleading information.

However, PwC signed off on LCF’s account without reporting its suspicions to the FCA.

Anthony Harrison, financial services regulatory expert at Pinsent Masons, said: “Where firms, or other advisory businesses that fall under the FCA’s remit, decide to ‘sit’ on compliance issues about which a regulator would reasonably expect to be informed, that can sometimes stir up more trouble than the original issues themselves. Firms and other relevant businesses tend to be much better off in being up front with the regulator at an early stage, rather than sweeping things under the carpet.”

Auditors have privileged access to information and are required by law to report any suspicions of fraud or non-compliance to the FCA.

Harrison said: “The recent FCA actions emphasise the significant role auditors play in the regulatory ‘ecosystem’ and the reliance that regulators place on them to help oversee the marketplace. Taking such action lays down an important marker that auditors who fall short of their regulatory responsibilities may face significant exposure and, in some cases, hefty financial penalties.”

These enforcements are consistent with the FCA’s three-year strategy, “demonstrating its commitment to take proactive action aimed at reducing and preventing serious harm, as well as protecting wider market confidence”, said Harrison.

“It wouldn’t be surprising to see more censures and fines of this nature being issued over the remainder of this year,” he said.

This is a 60% increase from 10 years ago when the average amount of tax paid by a non-dom individual was £76,000, the law firm Pinsent Masons reported.

The total amount of tax paid by non-doms overall has risen by 8% in the past year to £8.49bn ($10.9bn, €9.9bn). The data also shows that the amount of capital gains tax paid by non-doms rose 56% in the last year alone to £526m.

Sophie Warren, tax manager at Pinsent Masons, said: “Non-doms now more than ‘pay their way’ in the British economy. HMRC now brings in more in tax from non-doms than it does from inheritance tax or customs duties.

“The rise in tax paid by non-doms suggests that the cost of living crisis has affected them to an extent too. As many non-doms pay tax on money they remit to the UK, it’s likely that more of them are having to send money here from overseas to pay for increased costs.

“The big jump in CGT paid by non-doms is likely down to them selling UK property portfolios as residential property investment becomes less profitable. A lot of that money that will make its way into other parts of the UK economy through investment in other areas outside property.”

This news comes after Pinsent Masons reported back in January 2023 that the number of new non-dom taxpayers in the UK dropped by 40% in the past year.

The OCW unit is part of HMRC’s Fraud Investigation Service (FIS), which was set up in the wake of the Panama Papers leak in 2016 with a brief to target deliberate, high-value tax evasion, fraud and money laundering. Wealthy individuals, which are those earning over £200,000 ($246,049, €227,514) each year, are a major part of OWC’s focus.

Investigations by OCW include that of BHS owner Dominic Chappell, who was sentenced to six years of imprisonment in 2020 for tax evasion, and the current investigation into Bernie Ecclestone, who is due to stand trial later this year following a complex and worldwide criminal investigation.

Over the past decade, HMRC’s approach to economic crime enforcement has evolved to focus on the largest and most complex cases of tax fraud. The data reveals that, in 2009/10, HMRC undertook just 165 prosecutions, protecting approximately £150m in tax revenue.

But, although by 2019/20 the number of prosecutions had risen almost fourfold to 573, the revenue protected had increased 33-fold to approximately £5bn.

‘Secure prosecutions’

Andrew Sackey, partner at Pinsent Masons and former head of OCW, said: “As the name implies, OCW is the spearhead for HMRC’s drive to tackle the most complex and impactful cases of tax evasion and fraud. It is aiming to secure prosecutions against corporates or wealthy individuals whose deliberate actions are believed to have defrauded the public purse of hundreds of millions of pounds.

“The Treasury consistently provides HMRC with significant funds and resources each year to investigate a range of serious non-compliance including the suspected conduct of high net worth individuals. If the amount of tax revenue it protects through these investigations keeps rising, the government is likely to continue to invest in this high-end form of tax enforcement.”

He adds that HMRC is rapidly growing its use of data-sharing between both government agencies worldwide and increasingly engaging in strategic public-private partnerships.

“HMRC and its counterparts overseas are making it increasingly likely that tax irregularities, evasion and fraud will be detected,” Sackey said. “The amount of data shared between them each year is growing substantially – as it their ability to process and understand that data to identify enforcement opportunities. As financial institutions are increasingly brought into that fold as trusted partners, that process is only going to accelerate.”

A spokesperson for HMRC said: “Our record of tackling serious fraud speaks for itself. We take robust action to make sure that everyone pays the tax due. In recent years, we have deliberately focussed on the most harmful, complex and sophisticated frauds using both criminal and civil interventions.”

This follows its announcement in December 2022 that it wants to achieve a 100% increase of the amount of the money managed by local funds and introduce new types of regulated investment funds.

The newly established fund regime aims to revamp the existing legislative framework relating to the incorporation and governance of public and private funds established in the UAE and to grow the local UAE funds market.

Al Tamini said: “The changes include, inter alia, expedited processing periods for the approval of public/private funds, reduction of regulatory requirements and additional types of funds recognised by SCA.

“The new fund regulations have expanded the exemptions of arrangements that would not be considered as a fund to cover joint bank accounts, insurance and pension contracts, joint investments between the parent, holding, subsidiary and sister companies, timeshare properties and other sharing property use, employees share options schemes managed by the issuer or group company and government funds.”

SCA has introduced two fund structures which are:

• Family funds – a local fund where the ownership of its units is restricted to one or more persons from one family; and
• Self-managed funds – where a local fund is established by two or more individuals or corporates.

In addition, the regulation establishes new categories of specialised funds such as real estate development funds, precious metal funds, direct financing funds, ESG funds, capital protection funds, protected-cell funds, charity investment funds and commodities investment funds.

Numbers

Al Tamini & Co added that an “important measure” in the SCA regime is the reduction in capital requirements of fund management companies to AED1m from AED50m (£11m, $13.6m, €12.5m)and fund administration companies to AED1m from AED5m. It also removes foreign ownership restrictions, allowing 100% foreign ownership of such companies.

Furthermore, the application process timelines have been reduced to five working days for private funds and 10 working days for public funds for the approval of establishment of the respective fund. The SCA’s final decision on applications for new types of funds will be issued within 20 working days from the date of submission.

Al Tamini said: “While existing funds would need to conduct suitable due diligence to ensure compliance with the new fund regulations, it is worthy to note that there are some exemptions.

“Additionally, such funds are permitted to continue with activities as per the categorization and investment policy set out in their offering document. In the event no categorisation or investment policy is set out then compliance on such matters in accordance with the new fund regulation shall apply.

“It is expected that the SCA will issue a separate decision on the regulation of joint investment plans and investment funds linked to insurance products established by UAE licensed insurance companies and until further notice, status quo can be maintained.”

Further provisions under the newly established SCA regime include:

• Investment funds may issue and offer sukuk and bonds for the general public;
• Public real estate funds may be offered to the public through the book building mechanism;
• Permitting mergers and acquisitions of local investment funds;
• Buyback rules of investment funds traded on the stock exchange; and
• Capital increases of investment funds may be increased in instalments and tranches.

Separately, the SCA has also issued an administrative decision that contains annexes to the regulations, which contain guidelines on the content of the offering document and Key Investor Information Document (Kiid); the investment policies of the local funds; classifications of local funds; and the evaluation of units of the local public fund.

Foreign funds

The regime comes as SCA recently stopped the renewal of foreign investment funds aimed at the public.

Al Tamini said that SCA has also issued the Foreign Funds Promotion Regulation that provides new criteria on the promotion, offering, and registration of foreign funds to investors in the UAE.

The regulator has issued approvals to 1,965 foreign funds to promote and offer their funds through licensed promoters in the UAE. The intention of the Foreign Funds Promotion Regulation is to restrict the access of foreign funds to UAE retail investors.

The promotion of foreign funds in the UAE can only be made by way of private placement to professional and counterparty investors. The law firm said that investors “appear to be restricted from accessing public foreign funds under the Foreign Funds Promotion Regulations”.

UAE licensed promoters have been provided a grace period of six months, from 1 January 2023, to continue with existing promotion arrangements or until the remaining period of those arrangements expire, whichever is earlier.

It is expected that the SCA will issue a circular and will reach out to promoters on existing foreign funds that have been registered with the SCA to provide further guidance.

The Foreign Funds Promotion Regulations is effective as of 17 January 2023.

Foster growth for domestic funds

Tom Bicknell, partner at Pinsent Masons, told International Adviser: “SCA’s recently introduced restriction on the promotion of foreign funds to retail investors comes in parallel to their overhaul of the domestic funds regime.

“Widely seen as a move to foster growth of the domestic funds industry, foreign funds can now only be promoted to professional investors and market counterparties. Promoters have a maximum six-month grace period to cease the promotion of foreign funds to their retail clients.

“SCA’s new funds regime has been released with the intent of doubling the amount of investments managed by funds locally. Indeed, shortened timelines, expanded fund categories and reduction in minimum capital requirements are all directed at aligning SCA’s regime with international best practice.”

Nigel Sillitoe, founder and chief executive of Insight Discovery, told IA: “The main regulator of funds – in this case, SCA – and other policymakers, face an important decision: what sort of funds industry do they want for the UAE?

“On one hand, the industry could be one where most of the funds – in terms of numbers and AuM – are Ucits or other products that are domiciled elsewhere and that are distributed across national borders. On the other hand, the industry could be one where most of the funds are domiciled locally.

“Ucits and other foreign-domiciled funds have a number of attractions. There is no one model of a market for investment funds that is the best for all countries. Nevertheless, and in two landmark decisions made in mid-January, the SCA has made it absolutely clear that it wants the latter – an industry that is dominated by locally based funds.”